@einlogic/mcp-fitbit 1.0.1 → 2.1.0

package/build/auth.js

@@ -1,36 +1,40 @@
 import dotenv from 'dotenv';
 import express from 'express';
+import crypto from 'crypto';
 import open from 'open';
 import path from 'path';
 import { AuthorizationCode } from 'simple-oauth2';
 import { fileURLToPath } from 'url';
 import fs from 'fs/promises';
 import { existsSync } from 'fs';
-import { FITBIT_OAUTH_CONFIG } from './config.js';
+import { GOOGLE_OAUTH_CONFIG, GOOGLE_HEALTH_API_BASE, FILE_PATHS, ERROR_MESSAGES, HTTP_CONFIG, resolveClientCredentials, } from './config.js';
 // Determine the directory of the current module (build/auth.js)
 const currentFilename = fileURLToPath(import.meta.url);
 const currentDirname = path.dirname(currentFilename);
 // Load environment variables from .env file located in the project root
 const envPath = path.resolve(currentDirname, '..', '.env');
 dotenv.config({ path: envPath });
-// Fitbit OAuth2 Configuration
-const fitbitConfig = {
+// Google OAuth2 Configuration
+const clientCredentials = resolveClientCredentials();
+const googleConfig = {
     client: {
-        id: process.env.FITBIT_CLIENT_ID || '',
-        secret: process.env.FITBIT_CLIENT_SECRET || '',
+        id: clientCredentials.id,
+        secret: clientCredentials.secret,
     },
     auth: {
-        tokenHost: 'https://api.fitbit.com',
-        authorizePath: 'https://www.fitbit.com/oauth2/authorize',
-        tokenPath: 'https://api.fitbit.com/oauth2/token',
+        tokenHost: GOOGLE_OAUTH_CONFIG.TOKEN_HOST,
+        tokenPath: GOOGLE_OAUTH_CONFIG.TOKEN_PATH,
+        authorizeHost: GOOGLE_OAUTH_CONFIG.AUTHORIZE_HOST,
+        authorizePath: GOOGLE_OAUTH_CONFIG.AUTHORIZE_PATH,
     },
     options: {
-        authorizationMethod: 'header',
+        // Google expects client_id/client_secret in the form body of token requests
+        authorizationMethod: 'body',
     },
 };
 // OAuth2 Redirect URI and local server port
-const REDIRECT_URI = 'http://localhost:3000/callback';
-const PORT = 3000;
+const REDIRECT_URI = GOOGLE_OAUTH_CONFIG.CALLBACK_URI;
+const PORT = Number(new URL(REDIRECT_URI).port) || 3000;
 // --- State Management ---
 // Storage for the access token and token data
 let accessToken = null;
@@ -38,16 +42,15 @@ let tokenData = null;
 // Holds the temporary HTTP server instance used for the OAuth callback
 let oauthServer = null;
 // --- File paths for token persistence ---
-const TOKEN_FILE_PATH = path.resolve(currentDirname, '..', '.fitbit-token.json');
+const TOKEN_FILE_PATH = path.resolve(currentDirname, '..', FILE_PATHS.TOKEN_STORAGE);
 // --- OAuth Client Initialization ---
-const oauthClient = new AuthorizationCode(fitbitConfig);
+const oauthClient = new AuthorizationCode(googleConfig);
 /**
  * Saves the token data to a file for persistence
- * @param tokenData The token data to save
  */
-async function saveTokenToFile(tokenData) {
+async function saveTokenToFile(data) {
     try {
-        await fs.writeFile(TOKEN_FILE_PATH, JSON.stringify(tokenData, null, 2), 'utf8');
+        await fs.writeFile(TOKEN_FILE_PATH, JSON.stringify(data, null, 2), 'utf8');
         console.error(`Token saved to ${TOKEN_FILE_PATH}`);
     }
     catch (error) {
@@ -74,11 +77,82 @@ async function loadTokenFromFile() {
         return null;
     }
 }
-// --- Fitbit Authorization Flow ---
 /**
- * Initiates the Fitbit OAuth2 authorization code flow.
+ * Checks that the authorized Google Account is linked to Google Health.
+ * @returns true when linked (or when the check could not decide), false when
+ *          the API reports ACCOUNT_NOT_LINKED.
+ */
+async function verifyAccountLinked(token) {
+    try {
+        const response = await fetch(`${GOOGLE_HEALTH_API_BASE}/users/me/identity`, {
+            headers: {
+                'User-Agent': HTTP_CONFIG.USER_AGENT,
+                Authorization: `Bearer ${token}`,
+                Accept: 'application/json',
+            },
+        });
+        if (response.ok) {
+            console.error('Google Health identity verified.');
+            return true;
+        }
+        const body = await response.text();
+        if (response.status === 400 && body.includes('ACCOUNT_NOT_LINKED')) {
+            console.error(ERROR_MESSAGES.ACCOUNT_NOT_LINKED);
+            return false;
+        }
+        console.error(`Identity check returned HTTP ${response.status}: ${body}. Continuing.`);
+        return true;
+    }
+    catch (error) {
+        console.error('Identity check failed, continuing:', error);
+        return true;
+    }
+}
+function isExpired(data) {
+    if (!data.expires_at)
+        return false;
+    // Refresh a minute early to avoid racing the expiry
+    return new Date(data.expires_at).getTime() - 60_000 < Date.now();
+}
+/**
+ * Refreshes the access token if it has expired. Google does not return a new
+ * refresh token on refresh, so the existing one is carried over.
+ */
+async function refreshTokenIfNeeded() {
+    if (!tokenData || !isExpired(tokenData)) {
+        return;
+    }
+    const refreshToken = tokenData.refresh_token;
+    if (!refreshToken) {
+        console.error('Token is expired and no refresh token is available.');
+        accessToken = null;
+        tokenData = null;
+        return;
+    }
+    console.error('Token is expired. Attempting to refresh...');
+    try {
+        const accessTokenObj = oauthClient.createToken(tokenData);
+        const refreshed = await accessTokenObj.refresh();
+        const refreshedData = refreshed.token;
+        if (!refreshedData.refresh_token) {
+            refreshedData.refresh_token = refreshToken;
+        }
+        tokenData = refreshedData;
+        accessToken = refreshedData.access_token;
+        await saveTokenToFile(refreshedData);
+        console.error('Token refreshed and saved successfully.');
+    }
+    catch (refreshError) {
+        console.error('Failed to refresh token:', refreshError);
+        accessToken = null;
+        tokenData = null;
+    }
+}
+// --- Google Authorization Flow ---
+/**
+ * Initiates the Google OAuth2 authorization code flow.
  * Starts a temporary local web server to handle the redirect callback.
- * Opens the user's browser to the Fitbit authorization page.
+ * Opens the user's browser to the Google consent page.
  */
 export function startAuthorizationFlow() {
     // Prevent multiple authorization flows from running simultaneously
@@ -87,36 +161,57 @@ export function startAuthorizationFlow() {
         return;
     }
     // Ensure Client ID and Secret are loaded before starting
-    if (!fitbitConfig.client.id || !fitbitConfig.client.secret) {
-        console.error('Error: Fitbit Client ID or Secret not found. Check environment variables.');
+    if (!googleConfig.client.id || !googleConfig.client.secret) {
+        console.error('Error: Google Health Client ID or Secret not found. Check environment variables.');
         return;
     }
     const app = express();
-    // Generate the Fitbit authorization URL
-    const authorizationUri = oauthClient.authorizeURL({
+    // CSRF protection: the callback must echo this value
+    const expectedState = crypto.randomBytes(16).toString('hex');
+    // Generate the Google authorization URL
+    const baseAuthorizationUri = new URL(oauthClient.authorizeURL({
         redirect_uri: REDIRECT_URI,
-        // Define necessary scopes required by the application
-        scope: FITBIT_OAUTH_CONFIG.SCOPES,
-    });
-    // Route to initiate the authorization flow by redirecting the user to Fitbit
+        scope: GOOGLE_OAUTH_CONFIG.SCOPES,
+        state: expectedState,
+    }));
+    // Request a refresh token, and force the consent screen so one is issued
+    baseAuthorizationUri.searchParams.set('access_type', 'offline');
+    baseAuthorizationUri.searchParams.set('prompt', 'consent');
+    const authorizationUri = baseAuthorizationUri.toString();
+    const shutdownServer = (reason) => {
+        if (oauthServer) {
+            oauthServer.close(() => {
+                console.error(reason);
+            });
+            oauthServer = null;
+        }
+    };
+    // Route to initiate the authorization flow by redirecting the user to Google
     app.get('/auth', (req, res) => {
-        console.error('Redirecting to Fitbit for authorization...');
+        console.error('Redirecting to Google for authorization...');
         res.redirect(authorizationUri);
     });
-    // Callback route that Fitbit redirects to after user authorization
+    // Callback route that Google redirects to after user authorization
     app.get('/callback', async (req, res) => {
         const code = req.query.code;
+        const state = req.query.state;
+        if (req.query.error) {
+            console.error(`Authorization denied or failed: ${req.query.error}`);
+            res.status(400).send(`Authorization failed: ${req.query.error}`);
+            shutdownServer('OAuth server closed after authorization error.');
+            return;
+        }
+        if (state !== expectedState) {
+            console.error('OAuth state mismatch in callback.');
+            res.status(400).send('Error: Invalid state parameter.');
+            shutdownServer('OAuth server closed due to state mismatch.');
+            return;
+        }
         // Handle cases where the authorization code is missing
         if (!code) {
             console.error('Authorization code missing in callback.');
             res.status(400).send('Error: Authorization code missing.');
-            // Attempt to close the server if it exists
-            if (oauthServer) {
-                oauthServer.close(() => {
-                    console.error('OAuth server closed due to missing code.');
-                });
-                oauthServer = null;
-            }
+            shutdownServer('OAuth server closed due to missing code.');
             return;
         }
         console.error('Received authorization code. Exchanging for token...');
@@ -124,14 +219,18 @@ export function startAuthorizationFlow() {
         try {
             // Exchange the authorization code for an access token
             const tokenResult = await oauthClient.getToken(tokenParams);
+            const newToken = tokenResult.token;
             console.error('Access Token received successfully!');
-            accessToken = tokenResult.token.access_token;
-            tokenData = tokenResult.token;
-            // Persist token data to file
-            if (tokenData) {
-                await saveTokenToFile(tokenData);
-                console.error('Token data has been persisted to file');
+            // Only treat the account as connected once Google Health recognises it
+            const linked = await verifyAccountLinked(newToken.access_token);
+            if (!linked) {
+                res.status(400).send(ERROR_MESSAGES.ACCOUNT_NOT_LINKED);
+                return;
             }
+            accessToken = newToken.access_token;
+            tokenData = newToken;
+            await saveTokenToFile(newToken);
+            console.error('Token data has been persisted to file');
             res.send('Authorization successful! You can close this window. The MCP Server is now authenticated.');
         }
         catch (error) {
@@ -142,7 +241,6 @@ export function startAuthorizationFlow() {
                 try {
                     const errorDetails = await typedError.response.text();
                     console.error('Error details:', errorDetails);
-                    // Optionally parse errorDetails if it's JSON and log typedError.response.body
                 }
                 catch {
                     console.error('Could not parse error response body.');
@@ -154,20 +252,14 @@ export function startAuthorizationFlow() {
         }
         finally {
             // Ensure the temporary server is always shut down after handling the callback
-            if (oauthServer) {
-                console.error('Shutting down temporary OAuth server...');
-                oauthServer.close(() => {
-                    console.error('OAuth server closed.');
-                    oauthServer = null;
-                });
-            }
+            shutdownServer('OAuth server closed.');
         }
     });
     // Start the temporary local server
     oauthServer = app.listen(PORT, async () => {
         const authUrl = `http://localhost:${PORT}/auth`;
         console.error(`--------------------------------------------------------------------`);
-        console.error(`ACTION REQUIRED: Fitbit Authorization Needed`);
+        console.error(`ACTION REQUIRED: Google Health Authorization Needed`);
         console.error(`Attempting to open authorization page in your browser:`);
         console.error(authUrl);
         console.error(`If the browser doesn't open, please navigate there manually.`);
@@ -189,41 +281,65 @@ export function startAuthorizationFlow() {
     });
 }
 /**
- * Retrieves the current Fitbit access token.
+ * Stops a pending authorization callback server (if any) and waits until its
+ * port is free, so a new flow can bind to it.
+ */
+async function stopAuthorizationServer() {
+    const server = oauthServer;
+    if (!server)
+        return;
+    oauthServer = null;
+    await new Promise((resolve) => {
+        server.close(() => resolve());
+        // Drop keep-alive connections (e.g. an open browser tab) so close() completes
+        server.closeAllConnections?.();
+    });
+}
+/**
+ * Forgets the current token: clears it from memory and deletes the token file.
+ * @returns true when a token file was deleted, false when there was none.
+ */
+export async function clearStoredToken() {
+    accessToken = null;
+    tokenData = null;
+    try {
+        await fs.unlink(TOKEN_FILE_PATH);
+        console.error(`Token file deleted: ${TOKEN_FILE_PATH}`);
+        return true;
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return false;
+        throw error;
+    }
+}
+/**
+ * Clears the local tokens and starts a fresh authorization flow. Any flow that
+ * is still waiting for a callback is cancelled first. The new token is stored
+ * (in memory and on disk) once the user finishes consent in the browser.
+ * @returns whether a token file was removed, and the URL that starts consent
+ *          (null when the flow could not start, e.g. missing client credentials).
+ */
+export async function reauthenticate() {
+    await stopAuthorizationServer();
+    const tokenFileCleared = await clearStoredToken();
+    startAuthorizationFlow();
+    return {
+        tokenFileCleared,
+        authUrl: oauthServer ? `http://localhost:${PORT}/auth` : null,
+    };
+}
+/**
+ * Retrieves the current Google Health access token.
  * Automatically checks for token expiry and refreshes if necessary.
  * @returns The access token string or null if not available.
  */
 export async function getAccessToken() {
-    // Return null if no token data exists
     if (!tokenData || !accessToken) {
-        console.error('No valid access token found.'); // Added missing console.error and fixed surrounding logic
+        console.error('No valid access token found.');
         return null;
     }
-    // Check if token is expired
-    if (tokenData.expires_at && new Date(tokenData.expires_at) < new Date()) {
-        console.error('Token is expired. Attempting to refresh...');
-        try {
-            // Create AccessToken instance from the current token data
-            // FitbitTokenData is compatible with the 'Token' type expected by createToken
-            const accessTokenObj = oauthClient.createToken(tokenData);
-            // Refresh the token
-            if (accessTokenObj.expired()) {
-                const refreshedToken = await accessTokenObj.refresh();
-                accessToken = refreshedToken.token.access_token;
-                tokenData = refreshedToken.token;
-                // Save the refreshed token
-                await saveTokenToFile(tokenData);
-                console.error('Token refreshed and saved successfully.');
-                return accessToken;
-            }
-        }
-        catch (refreshError) {
-            console.error('Failed to refresh token:', refreshError);
-            accessToken = null;
-            tokenData = null;
-            return null;
-        }
-    }
+    await refreshTokenIfNeeded();
     return accessToken;
 }
 /**
@@ -233,39 +349,15 @@ export async function getAccessToken() {
 export async function initializeAuth() {
     console.error('Auth initialized. Checking for persisted token...');
     try {
-        // Load token data from file
         tokenData = await loadTokenFromFile();
         if (tokenData && tokenData.access_token) {
             accessToken = tokenData.access_token;
             console.error('Persisted access token loaded successfully.');
-            // Check if token is expired and needs refresh
-            if (tokenData.expires_at && new Date(tokenData.expires_at) < new Date()) {
-                console.error('Token is expired. Attempting to refresh...');
-                try {
-                    // Create AccessToken instance from the loaded token data
-                    // FitbitTokenData is compatible with the 'Token' type expected by createToken
-                    const accessTokenObj = oauthClient.createToken(tokenData);
-                    // Refresh the token
-                    if (accessTokenObj.expired()) {
-                        const refreshedToken = await accessTokenObj.refresh();
-                        accessToken = refreshedToken.token.access_token;
-                        tokenData = refreshedToken.token;
-                        // Save the refreshed token
-                        if (tokenData) {
-                            await saveTokenToFile(tokenData);
-                            console.error('Refreshed token saved successfully.');
-                        }
-                    }
-                }
-                catch (refreshError) {
-                    console.error('Error refreshing token:', refreshError);
-                    accessToken = null;
-                    tokenData = null;
-                }
-            }
+            await refreshTokenIfNeeded();
         }
         else {
             console.error('No valid access token found.');
+            tokenData = null;
         }
     }
     catch (error) {

package/build/azm-timeseries.js

@@ -1,4 +1,5 @@
-import { registerTool, CommonSchemas, handleFitbitApiCall } from './utils.js';
+import { registerTool, CommonSchemas, dailyRollUp } from './utils.js';
+import { VALIDATION_MESSAGES } from './config.js';
 /**
  * Registers an Active Zone Minutes time series tool with the MCP server.
  * @param server The McpServer instance.
@@ -7,16 +8,11 @@ import { registerTool, CommonSchemas, handleFitbitApiCall } from './utils.js';
 export function registerAzmTimeSeriesTool(server, getAccessTokenFn) {
     registerTool(server, {
         name: 'get_azm_timeseries',
-        description: "Get the raw JSON response for Active Zone Minutes (AZM) time series data from Fitbit over a date range (max 1095 days). Returns total AZM plus breakdown by fat burn, cardio, and peak zones.",
+        description: `Get the raw JSON response for daily Active Zone Minutes (AZM) roll-ups from the Google Health API (dailyRollUp of "active-zone-minutes") over a civil date range. startDate is inclusive, endDate is exclusive. ${VALIDATION_MESSAGES.MAX_RANGE_90_DAYS}.`,
         parametersSchema: {
             startDate: CommonSchemas.startDate,
             endDate: CommonSchemas.endDate,
         },
-        handler: async ({ startDate, endDate }) => {
-            const endpoint = `activities/active-zone-minutes/date/${startDate}/${endDate}.json`;
-            return handleFitbitApiCall(endpoint, { startDate, endDate }, getAccessTokenFn, {
-                errorContext: `AZM data from ${startDate} to ${endDate}`
-            });
-        }
+        handler: async ({ startDate, endDate, }) => dailyRollUp('active-zone-minutes', getAccessTokenFn, { startDate, endDate }, `AZM data from ${startDate} to ${endDate}`),
     });
 }

package/build/compat/api.js

@@ -0,0 +1,136 @@
+/**
+ * Google Health API access helpers for the Fitbit-compatible output mode.
+ * Unlike the proxy tools these fetch *all* pages and return typed arrays, because the
+ * compat tools aggregate several calls into one Fitbit-shaped response.
+ */
+import { makeGoogleHealthRequest, dataPointsPath, buildDailyRollUpBody, buildRangeFilter, createErrorResponse, GoogleHealthApiError, } from '../utils.js';
+import { ERROR_MESSAGES } from '../config.js';
+import { buildFitbitZones, rollupDate, zoneBoundsByDate, } from './convert.js';
+// === Error handling ===
+/** Runs a compat handler and converts failures into MCP error responses. */
+export async function guard(context, fn) {
+    try {
+        return await fn();
+    }
+    catch (error) {
+        if (error instanceof GoogleHealthApiError) {
+            if (error.status === 400 && error.body.includes('ACCOUNT_NOT_LINKED')) {
+                return createErrorResponse(ERROR_MESSAGES.ACCOUNT_NOT_LINKED);
+            }
+            return createErrorResponse(`${ERROR_MESSAGES.API_REQUEST_FAILED} for ${context} (HTTP ${error.status}): ${error.body}`);
+        }
+        return createErrorResponse(`${ERROR_MESSAGES.API_REQUEST_FAILED} for ${context}: ${error instanceof Error ? error.message : String(error)}`);
+    }
+}
+async function request(path, getToken, options = {}) {
+    const result = await makeGoogleHealthRequest(path, getToken, options);
+    if (result === null)
+        throw new Error(ERROR_MESSAGES.NO_ACCESS_TOKEN);
+    return result;
+}
+// === Paging helpers ===
+/** Lists every data point matching a filter, following nextPageToken. */
+export async function listAll(dataType, getToken, params) {
+    const out = [];
+    let pageToken;
+    for (let page = 0; page < (params.maxPages ?? 20); page++) {
+        const res = await request(dataPointsPath(dataType), getToken, {
+            query: { filter: params.filter, pageSize: params.pageSize, pageToken },
+        });
+        out.push(...(res.dataPoints ?? []));
+        pageToken = res.nextPageToken;
+        if (!pageToken)
+            break;
+    }
+    return out;
+}
+/** Daily roll-up of a data type over [startDate, endDateExclusive), following nextPageToken. */
+export async function rollUpAll(dataType, getToken, startDate, endDateExclusive, maxPages = 20) {
+    const out = [];
+    let pageToken;
+    for (let page = 0; page < maxPages; page++) {
+        const res = await request(dataPointsPath(dataType, ':dailyRollUp'), getToken, {
+            method: 'POST',
+            body: {
+                ...buildDailyRollUpBody(startDate, endDateExclusive),
+                ...(pageToken ? { pageToken } : {}),
+            },
+        });
+        out.push(...(res.rollupDataPoints ?? []));
+        pageToken = res.nextPageToken;
+        if (!pageToken)
+            break;
+    }
+    return out;
+}
+const CONTEXT_TTL_MS = 60 * 60 * 1000;
+let cachedContext = null;
+export function resetCompatCaches() {
+    cachedContext = null;
+}
+/** The account's time zone and display units, from Google Health settings (cached for an hour). */
+export async function getUserContext(getToken) {
+    if (cachedContext && Date.now() - cachedContext.at < CONTEXT_TTL_MS) {
+        return cachedContext.value;
+    }
+    let value;
+    try {
+        const settings = await request('users/me/settings', getToken);
+        value = {
+            timeZone: process.env.COMPAT_TIME_ZONE || settings.timeZone || 'UTC',
+            weightUnit: settings.weightUnit,
+            distanceUnit: settings.distanceUnit,
+            waterUnit: settings.waterUnit,
+        };
+    }
+    catch (error) {
+        console.error('Could not load Google Health settings, using defaults:', error);
+        return { timeZone: process.env.COMPAT_TIME_ZONE || 'UTC' };
+    }
+    cachedContext = { value, at: Date.now() };
+    return value;
+}
+// === Heart-rate zones ===
+/**
+ * Fitbit-style zones per civil date over [startDate, endDateExclusive), built from Google's own
+ * zone data: Active Zone Minutes / time-in-zone for minutes, calories-in-zone for kcal and
+ * daily-heart-rate-zones for the bpm bounds. Individual source failures degrade to missing
+ * fields (reported in `notes`); if every minutes source fails the first error is thrown.
+ */
+export async function getZonesForRange(getToken, startDate, endDateExclusive) {
+    const [azm, tiz, kcal, bounds] = await Promise.allSettled([
+        rollUpAll('active-zone-minutes', getToken, startDate, endDateExclusive, 60),
+        rollUpAll('time-in-heart-rate-zone', getToken, startDate, endDateExclusive, 60),
+        rollUpAll('calories-in-heart-rate-zone', getToken, startDate, endDateExclusive, 60),
+        listAll('daily-heart-rate-zones', getToken, {
+            filter: buildRangeFilter('daily_heart_rate_zones.date', startDate, endDateExclusive),
+            pageSize: 10000,
+        }),
+    ]);
+    if (azm.status === 'rejected' && tiz.status === 'rejected')
+        throw azm.reason;
+    const notes = [];
+    const value = (r, what) => {
+        if (r.status === 'fulfilled')
+            return r.value;
+        notes.push(`${what} unavailable: ${r.reason instanceof Error ? r.reason.message : String(r.reason)}`);
+        return [];
+    };
+    const byDate = (points) => new Map(points.flatMap((p) => (rollupDate(p) ? [[rollupDate(p), p]] : [])));
+    const azmByDate = byDate(value(azm, 'Active Zone Minutes'));
+    const tizByDate = byDate(value(tiz, 'time-in-heart-rate-zone'));
+    const kcalByDate = byDate(value(kcal, 'calories-in-heart-rate-zone'));
+    const boundsByDate = zoneBoundsByDate(value(bounds, 'daily-heart-rate-zones'));
+    const zones = new Map();
+    for (const date of new Set([...azmByDate.keys(), ...tizByDate.keys()])) {
+        const built = buildFitbitZones({
+            azm: azmByDate.get(date),
+            timeInZone: tizByDate.get(date),
+            calories: kcalByDate.get(date),
+            bounds: boundsByDate.get(date),
+        });
+        if (built)
+            zones.set(date, built);
+    }
+    return { zones, notes };
+}